121–130 of 180 posts
I have been advised by researchers in the field that it takes about a day with an optimizing compiler to de-obfuscate most any piece of commercial software of this size, with a good team. With a less than great team, perhaps about a week. Is that true?
Interesting read! I'd love to read the next post, but at least Miniflux can't find any feed. 3eed, would you be open to adding an RSS feed?
This is an awesome write-up; I’m shocked at the level of effort that went into Snap’s obfuscation process. It implies that are entire teams of engineers out there whose sole job it is to play cat&mouse with reverse engineers and nothing more. Another comment mentioned that this effort is outsourced, so not only are there teams, but entire companies dedicated to this! What a blast that must be... though the immense am…
>What a blast that must be... though the immense amount of [invested|wasted] (take your pick depending on cynicism) effort spent on this game makes me a little sad. All of these brilliant minds just... cosplaying Sisyphus? And we wonder why such a high % of tech workers have a deep discontent & are desperately searching for meaning.
How does one go about learning reverse engineering? Is it mostly by practicing? Are there any good up-to-date resources? I remember taking a reverse engineering course in the university where the professor didn't even bother to explain the basics, it was like black magic and left me frustrated, but I still feel amazed when I read blog posts like these.
If you dig very deep, you can also find an offer to come work at Snapchat. Most will never find it.
I'm curious, can anyone recommend any techniques (or companies providing solutions) for attempting something similar with javascript in a browser calling an API? Obviously it's much more difficult to obfuscate an algorithm for generating a client token in JS than it would be in assembly, but I'm just curious if anyone has tried any form of "lock down my API so it's only callable from the web front end I provide" obfu…
Both use some wacky methods for request signing that include encrypted code, obfuscated control flow, hashing the browser environment, ...
Assembly obviously allows for much more powerful obfuscation than Javascript. Webassembly is somewhere inbetween, but a viable path since it is pretty universally supported by now.
Networks requests can be inspected trivially in the browser though, which makes things a lot easier.
I have been advised by researchers in the field that it takes about a day with an optimizing compiler to de-obfuscate most any piece of commercial software of this size, with a good team. With a less than great team, perhaps about a week. Is that true?
Definitely not true.
I’m surprised that no one has mentioned how this is actually accomplished. The answer is: largely automatically, at the compiler level. Snapchat acquired Obfuscator-LLVM and the people behind it in 2017, which was actually partially open source for a period of time. It is a compiler backend for LLVM that obfuscates your code for you. You can read a bit about some of the techniques used on their old wiki: https://gith…
Funny thing about things like that is that you can likely write tools to automatically deobfuscate, if you know the mechanisms. Of course, this takes time and effort, and is beyond most spammers' capabilities.
Philosophically I never gave much thought to securing app client code. Why not just track usage stats and ban clearly fake/high throughput users?
Because Snapchat is ultimately an application designed to trade in porn of amateurs including (and perhaps especially) teenagers. They have a vested interest in playing dumb to that fact. They can't really do so if the content escapes out into the wild and shows up in congressional hearings, lawsuits, FBI investigations, DOJ reports, etc.
Philosophically I never gave much thought to securing app client code. Why not just track usage stats and ban clearly fake/high throughput users?
The issue is pulling images and chats out and potentially saving them, without notification to the sender. If the API was public Snapchat could no longer promise that images are temporary, because an unofficial client could store the images.